Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-06 | 2 | Disclosure1General1 |
| 2026-04-07 | 1 | Disclosure1 |
CVE-2026-35404 Open Redirect Vulnerability in Open edX Platform View Survey Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35404
Post summary
The post announces CVE‑2026‑35404, an open redirect flaw in Open edX’s survey endpoint, without providing PoCs, exploits, exploitation status, or mitigation details.
🚨*CVE* CVE-2026-35404 Open edX Platform enables the authoring and delivery of online learning at any scale. he view_survey endpoint accepts a redirect_url GET parameter that is passed dire… https://www.cve.org/CVERecord?id=CVE-2026-35404 ----- Traducción: CVE-2026-35404 Ope… http://infoflow.cloud`
Post summary
The text announces CVE-2026-35404, describing an open‑redirect flaw in Open edX Platform’s view_survey endpoint that accepts a redirect_url GET parameter without proper validation.
CVE-2026-35404 Open edX Platform enables the authoring and delivery of online learning at any scale. he view_survey endpoint accepts a redirect_url GET parameter that is passed dire… https://www.cve.org/CVERecord?id=CVE-2026-35404
Post summary
The post briefly notes that CVE-2026-35404 involves a URL parameter flaw in the view_survey endpoint, but provides no details on exploitation, fixes, or PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openedx | openedx | - | - | - |